Executive brief
pam_usb is a tool that allows users to log into Linux systems using a USB flash drive as a physical key. A flaw in how the software handles simultaneous login requests can cause the system to crash or behave unpredictably when multiple authentication attempts happen at the same time. This could allow an attacker to disrupt the login service, preventing legitimate users from accessing the system.
Technical details
A race condition exists in src/log.c of pam_usb due to the use of a process-wide static pointer (pusb_opts) that stores the address of a stack-local variable during PAM invocation. This violates PAM re-entrancy requirements; when multiple threads invoke the PAM stack concurrently, one thread can clobber the pointer with its own stack address. If the second thread returns, the pointer becomes a dangling reference, leading to undefined behavior or a NULL pointer dereference (CWE-476) when the first thread subsequently attempts to log. This can be exploited locally to cause a Denial of Service (DoS) of the authentication process. The issue is fixed in version 0.9.1 by implementing thread-local storage for the affected pointer.
Affected products
- mcdope pam_usb < 0.9.1
Timeline
- 2026-05-23: advisory: GitHub security advisory published
- 2026-05-27: disclosed: CVE-2026-48066 published to NVD
- 2026-05-27: patched: Vulnerability fixed in version 0.9.1